Supply-chain artefacts
June 22, 2026 · View on GitHub
Honest status for customer conversations. This is not a commitment schedule.
| Capability | Status | What you do today |
|---|---|---|
| SBOM (SPDX 2.3 + CycloneDX 1.6) | Available | make sbom or scripts/gen-sbom |
| Config-accurate build properties | Available | Read wolfssl:build:* in .cdx.json |
| Embedded source-merkle checksum | Available | gen-sbom with --srcs (no libwolfssl.a required) |
| Commercial license in SBOM | Available | CRA_LICENSE_OVERRIDE=LicenseRef-wolfSSL-Commercial CRA_LICENSE_TEXT=/path/to/commercial-license.txt ./scripts/generate-wolfssl-sbom.sh (a LicenseRef-* override requires the licence text; or use make-commercial-sample.sh to derive from pinned GPL samples) |
| Reproducible SBOM timestamps | Available | SOURCE_DATE_EPOCH |
OmniBOR / make bomsh | Available | Linux build host only; optional for CRA |
pkg:github PURL | Available | Emitted natively by gen-sbom; resolves in OSV / GHSA / Snyk / Trivy without per-vendor mapping |
| Cryptographic-asset draft (CycloneDX 1.6) | Draft sample | Hand-rolled wolfssl-<ver>.cbom-draft.cdx.json alongside SBOM (4–6 starter entries); upstream automation: roadmap |
Formal CBOM (cryptographic-asset profile, all primitives) | Roadmap | Use draft sample + wolfssl:build:* properties |
| VEX templates / automation | Roadmap | Your scanner + wolfSSL advisories |
CSAF 2.0 advisory feed (/.well-known/csaf/) | Roadmap | Human-readable advisories today; CSAF 2.0 publication is on the roadmap (BSI's CRA reference architecture assumes CSAF) |
| Signed SBOMs (in-toto / cosign / Sigstore) | Roadmap | Unsigned today; signing is conspicuous-by-absence for a crypto vendor and is on the roadmap |
| SBOM publication channel | Roadmap | Per-release artefacts on GitHub Releases (proposed); wolfssl.com/sbom/ (proposed); discovery via PURL is the long-term goal |
| Product SBOM tool | Out of scope | Your BOM platform or manual merge |
Upstream implementation detail: wolfssl/doc/SBOM.md.
Vulnerability-handling roadmap (Pillar 4)
The kit's vulnerability-handling pillar is the only ongoing CRA obligation. Status of wolfSSL Inc.'s own filings is tracked here so customers can see what they're actually inheriting when they reference us as a component supplier.
| Capability | Status | Notes |
|---|---|---|
security.txt (RFC 9116) | Available | /.well-known/security.txt |
| Coordinated Vulnerability Disclosure policy | Available | /.well-known/vulnerability-disclosure-policy.txt |
| CNA status | Available | wolfSSL is a CVE Numbering Authority |
| Public SLA (24h ack / 72h triage) | Pending leadership approval | Will be added to CVD policy once approved |
| 24h ENISA reporting (Art. 14) runbook | In progress | Owner assignment pending; on-call rotation TBD |
| EU Authorised Representative (Art. 18) | In progress | wolfSSL Inc. is US-established; AR appointment underway |
| CSAF 2.0 advisory feed | Roadmap | See above |
See wolfssl-inc-auditor-packet/ for the manufacturer-side
filings wolfSSL Inc. ships under CRA.